system: add ECS field host.os.version #11106
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
zmoog added Integration:system 
andrewkroh added the Team:Obs-InfraObs 
🚀 Benchmarks reportPackage |
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
auth | 3154.57 | 2506.27 | -648.3 (-20.55%) | 💔 |
security | 1773.05 | 1375.52 | -397.53 (-22.42%) | 💔 |
To see the full report comment with /test benchmark fullreport
💚 Build Succeeded
History
cc @zmoog |
|
Member
Contributor Author
The #10848 tracks the classes of problems we identified based on our own and users' feedback. I am maintaining it as the source of truth for ecs@mappings issues. It would be great if each integration owner double-checks their integrations to see if they are affected. I am fixing all the cases I am aware of. |
harnish-crest-data approved these changes Sep 17, 2024
shmsr approved these changes Sep 17, 2024
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
Add ECS mapping for the `host.os.version` field (`keyword` type). Users reported mapping exceptions due to `host.os.version` numeric values causing field mapping as `float` instead of `long`. See elastic#10848 (comment) for more. Elasticsearch maps a field as a `float` if it has a numeric value. This happens even on stack versions 8.13+ because ecs@mappings does not perform type coercion. For example, Elasticsearch maps `7.9` as `float`, while it maps `"7.9" or "7.9 (Maipo)"` as `keyword`. By adding the `host.os.version` field to the file `fields/ecs.yml`, we ensure Elasticsearch uses the expected ECS field mapping as a `keyword` even when the value is a number. IMPORTANT: To fully resolve the issue, the input/integration owner should update it to emit the right value type to leverage ecs@mappings.
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
Add ECS mapping for the `host.os.version` field (`keyword` type). Users reported mapping exceptions due to `host.os.version` numeric values causing field mapping as `float` instead of `long`. See elastic#10848 (comment) for more. Elasticsearch maps a field as a `float` if it has a numeric value. This happens even on stack versions 8.13+ because ecs@mappings does not perform type coercion. For example, Elasticsearch maps `7.9` as `float`, while it maps `"7.9" or "7.9 (Maipo)"` as `keyword`. By adding the `host.os.version` field to the file `fields/ecs.yml`, we ensure Elasticsearch uses the expected ECS field mapping as a `keyword` even when the value is a number. IMPORTANT: To fully resolve the issue, the input/integration owner should update it to emit the right value type to leverage ecs@mappings.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Add ECS mapping for the
host.os.versionfield (keywordtype).Users reported mapping exceptions due to
host.os.versionnumeric values causing field mapping asfloatinstead oflong. See #10848 (comment) for more.Elasticsearch maps a field as a
floatif it has a numeric value. This happens even on stack versions 8.13+ because ecs@mappings does not perform type coercion. For example, Elasticsearch maps7.9asfloat, while it maps"7.9" or "7.9 (Maipo)"askeyword.By adding the
host.os.versionfield to the filefields/ecs.yml, we ensure Elasticsearch uses the expected ECS field mapping as akeywordeven when the value is a number.IMPORTANT: To fully resolve the issue, the input/integration owner should update it to emit the right value type to leverage ecs@mappings.
Checklist
changelog.ymlfile.Related issues